* [PATCH] wifi: iwlegacy: 3945: free EEPROM data on remove
@ 2026-09-16 7:37 Guangshuo Li
2026-09-16 11:19 ` Stanislaw Gruszka
0 siblings, 1 reply; 2+ messages in thread
From: Guangshuo Li @ 2026-09-16 7:37 UTC (permalink / raw)
To: Stanislaw Gruszka, John W. Linville, Ron Rindjunsky,
Tomas Winkler, linux-wireless, linux-kernel
Cc: Guangshuo Li, stable
il3945_pci_probe() calls il_eeprom_init(), which allocates memory for
the EEPROM data. The probe failure paths release this allocation with
il_eeprom_free(), but the remove path does not free it after a
successful probe.
As a result, the EEPROM data is leaked when the PCI device is removed.
Free the EEPROM data in il3945_pci_remove() before releasing the
mac80211 hardware structure.
This issue was found by manual code inspection.
Fixes: 073d3f5f1b3b ("iwlwifi: changing EEPROM layout handling")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
index cbaf250626c5..f7ca182d1494 100644
--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
@@ -3807,6 +3807,7 @@ il3945_pci_remove(struct pci_dev *pdev)
il_free_channel_map(il);
il_free_geos(il);
+ il_eeprom_free(il);
kfree(il->scan_cmd);
dev_kfree_skb(il->beacon_skb);
ieee80211_free_hw(il->hw);
--
2.43.0
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] wifi: iwlegacy: 3945: free EEPROM data on remove
2026-09-16 7:37 [PATCH] wifi: iwlegacy: 3945: free EEPROM data on remove Guangshuo Li
@ 2026-09-16 11:19 ` Stanislaw Gruszka
0 siblings, 0 replies; 2+ messages in thread
From: Stanislaw Gruszka @ 2026-09-16 11:19 UTC (permalink / raw)
To: Guangshuo Li
Cc: John W. Linville, Ron Rindjunsky, Tomas Winkler, linux-wireless,
linux-kernel, stable
On Wed, Sep 16, 2026 at 03:37:36PM +0800, Guangshuo Li wrote:
> il3945_pci_probe() calls il_eeprom_init(), which allocates memory for
> the EEPROM data. The probe failure paths release this allocation with
> il_eeprom_free(), but the remove path does not free it after a
> successful probe.
>
> As a result, the EEPROM data is leaked when the PCI device is removed.
>
> Free the EEPROM data in il3945_pci_remove() before releasing the
> mac80211 hardware structure.
>
> This issue was found by manual code inspection.
>
> Fixes: 073d3f5f1b3b ("iwlwifi: changing EEPROM layout handling")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
> ---
> drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> index cbaf250626c5..f7ca182d1494 100644
> --- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> +++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> @@ -3807,6 +3807,7 @@ il3945_pci_remove(struct pci_dev *pdev)
>
> il_free_channel_map(il);
> il_free_geos(il);
> + il_eeprom_free(il);
> kfree(il->scan_cmd);
> dev_kfree_skb(il->beacon_skb);
> ieee80211_free_hw(il->hw);
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-16 11:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-16 7:37 [PATCH] wifi: iwlegacy: 3945: free EEPROM data on remove Guangshuo Li
2026-09-16 11:19 ` Stanislaw Gruszka
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®